Sequence-of-Events Analysis of a Unit Trip
At 10:00:00.0 a 210 MW unit was steady at 205 MW. The sequence-of-events recorder shows: 10:00:00.2 drum level low-low; 10:00:00.4 both primary air (PA) fans trip; 10:00:00.6 all mills trip; 10:00:00.8 forced draft (FD) fan trip; 10:00:01.0 boiler trip; 10:00:01.2 turbine trip; 10:00:01.5 generator breaker open. The operator states that the boiler tripped first and the fan trips followed. The I&C engineer states that the PA fan trip is the root cause. The drum level transmitter was calibrated two days earlier, but the feedwater control valve had been in manual since an actuator failure. The feedwater pump was at 90% speed, and the drum level recorder shows a slow fall for 40 s before the first event. The PA fan motor current was normal until 0.4 s. The event recorder scan time is 0.1 s.
1. Construct the most probable cause-and-consequence order from the evidence. Which event is the root cause, and which are protective trips?
Read the worked answer
The drum level had been falling for 40 s before the first logged event, so low-low drum level at 0.2 s is an abnormal condition and a symptom of feedwater mismatch, not necessarily the initiating event. The first equipment trip is the PA fan trip at 0.4 s. The mills trip at 0.6 s, the FD fan at 0.8 s, the boiler at 1.0 s, the turbine at 1.2 s and the generator breaker at 1.5 s follow in a logical protective sequence. The most probable root cause is therefore the PA fan trip, or a common electrical/control cause affecting both PA fans. The boiler, turbine and generator trips are consequences. The low drum level is a contributing abnormal condition that may have made the unit less tolerant, but it does not explain why the PA fans tripped while motor current was normal just before 0.4 s.
2. Explain why the operator's statement and the I&C engineer's statement can both be partly right, and what additional evidence would discriminate between a PA fan electrical fault and a boiler/feedwater-induced trip.
Read the worked answer
The operator saw the boiler trip annunciation and the large plant response, which occurred after the PA fan trip; human observation has a delay of seconds. The I&C engineer is relying on the first-out sequence, but even that can mislead if scan time is 0.1 s and the PA fan breaker is tripped by a bus-voltage dip caused by an earlier electrical event. Both can be partly right: the boiler trip is real, but it may be a consequence rather than the cause. Discriminating evidence: PA fan breaker trip-coil operation, motor current and 6.6 kV bus voltage at 0.4 s, fan vibration and blade pitch, mill differential pressure, feedwater valve position and drum-level trend, and the DCS first-out alarm. If the PA breaker operated before any bus dip, the PA fault is primary. If bus voltage collapsed first and the PA breaker followed, the electrical supply event is primary. If drum level low-low initiated a boiler trip independent of the fans, the feedwater loop is primary.
3. Recommend the first three actions before restarting, and state one change to the event-analysis procedure.
Read the worked answer
Before restart: (1) verify the drum-level transmitter and the feedwater control valve, and confirm the manual/auto status and actuator repair; (2) inspect both PA fans, their motors, breakers and the 6.6 kV bus for the first electrical abnormality; (3) review the DCS first-out and analog trends for drum level, PA fan current, bus voltage and mill operation, and do not restart until the initiating event is identified. Change the event-analysis procedure to use a 1 ms sequence-of-events recorder with GPS time synchronization, first-out alarm capture and analog trend overlays. A 0.1 s scan is too coarse to separate a breaker operation from a bus-voltage dip, and relying on annunciator order alone can invert cause and consequence.